Routing and Remote Access Blog : Load Balancing

How to configure Network Load Balancing (NLB) based cluster of VPN Servers

rrasblog — Thu, 02 Jul 2009 13:37:00 GMT

Hello All, in this blog, I will discuss how to configure a "Network Load Balancing Cluster" of vpn servers to ensure high availability and scalability of vpn service.

For information about "Network Load Balancing (NLB)" feature in "Windows Server 2008 R2" please refer the following link: http://technet.microsoft.com/en-us/library/cc725691.aspx

How network load balancing cluster enhances scalability of vpn server?

To create a NLB VPN cluster each host runs Remote Access (VPN) Service & NLB Service. NLB allows all of the computers in the cluster to be addressed by the same cluster IP address. NLB distributes incoming client requests across the vpn servers in the cluster. The load weight to be handled by each vpn server can be configured as necessary. You can also add a vpn server dynamically to the cluster to handle increased load. In addition, NLB can direct all traffic to a designated single vpn server, which is called the default host.

How network load balancing cluster ensures high availability of vpn server?

When a vpn server fails or goes offline, active connection to the failed or offline server are lost. But new connection request is automatically redistributed among the vpn servers that are still operating. However, if you bring a host down intentionally, you can use "drainstop" command to service all active connection prior to bringing the computer offline. Drainstop allows the host to continue surviving active connections but disables all new traffic to that host.

How to configure a NLB cluster?

To configure the Network Load Balancing (NLB) cluster, you must configure three types of the parameters:

Host parameters, which are specific to each host in a NLB cluster.
Cluster parameters, which apply to an NLB cluster as a whole.
Port rules, which control how the cluster functions. By default, a port rule equally balances all TCP/IP traffic across all servers.

In the following section we will describe step by step guide to deploy an nlb cluster of vpn servers for test lab.

Verification step to make sure vpn server is configured properly before installing nlb:

1. Assign satic ip to vpn-server1 (say 201.0.0.1), vpn-server2 (say 201.0.0.2) [Note: NLB does not support DHCP. NLB disables DHCP on each interface that it configures, so the IP addresses must be static]

2. Ensure client is able to make vpn connection to both the servers for different tunnel types (PPTP, L2TP, SSTP or IKEv2).

Install & Configure NLB in vpn-servers:

3. Install NLB in vpn-server1 & vpn-server2.

4. Create a new cluster using the NLB manager [Open nlbmgr.msc (in Administrative tools)] of vpn-server1 according the steps mentioned below. Add host to the cluster, choose priority of the host & assign cluster IP (say 201.0.0.11).

a) Add new host to the cluster:

Give host name or ip address and select the interface of the host for configuring cluster.

b) Host parameter configuration:

c) Configuring the cluster parameter

Select cluster operation mode as unicast to specify that a unicast media access control (MAC) address should be used for cluster operation. In this mode, the MAC address of the cluster is assigned to the network adapter of the computer, and the built-in MAC address of the network adapter is not used. Unicast is the default setting for Cluster operation mode.

d) Configuring Port Rules:

· Select Affinity Single or Network to ensure that all network traffic from a particular client is directed to the same host.

· Select Filtering mode to Multiple hosts or Single host considering the following:

o The Multiple hosts parameter specifies that multiple hosts in the cluster will handle network traffic for the associated port rule. This filtering mode provides scaled performance and fault tolerance by distributing the network load among multiple hosts. You can specify that the load be equally distributed among the hosts or that each host will handle a specified load weight.

o The Single host parameter specifies that network traffic for the associated port rule be handled by a single host in the cluster according to the specified handling priority. This filtering mode provides port specific fault tolerance for handling network traffic.

5. Add vpn-server2 to the nlb cluster using nlb manager of the vpn-server1. (you can also do this step using the nlb manager of the vpn-server2 after "connecting to existing cluster" with cluster ip 201.0.0.11)

a) Add new host to the cluster

b) Host parameter configuration

c) Configuring Port Rules

d) Configuring load weight for the host

6. Ensure both the server got same MAC Address for that interface & Cluster IP. [Note: NLB automatically instructs the driver that belongs to the cluster adapter to override the adapter's unique, built-in network address and to change its MAC address to the cluster's MAC address. This is the address used on all cluster hosts.]

Verification after configuring nlb cluster for vpn server:

7. Make Connection from the client using Cluster IP. Connection should succeed & it should be connected to high priority server (vpn-sever1 in this case).

8. Give nlb drainstop on vpn-server1.

9. Drainstop allows the host to continue surviving active connections but disables all new traffic to that host. All new connections should go to vpn-server2.

10. Give nlb drainstop on the vpn-server2.

11. Now all new connections should fail since both the servers are in "drainstop" mode.

12. Give nlb start.

13. Client should be able to connect to vpn-server1.

With Regards,

Anupam Chakraborty (SDET, Windows Networking)

RRAS Performance results

rrasblog — Mon, 09 Feb 2009 14:06:00 GMT

Hello Customers,

A lot of you have requested directly or through the field channels about performance results of RRAS for different VPN tunnel types – specifically SSTP. I am writing this blog to share the results for the tests done internally by our test team (thanks Sai and other test team members).

First, a few guidelines to help you better interpret the test and results:

· The main goal of this performance test is to validate a target VPN server deployment in terms of the performance requirements i.e. x number of simultaneous VPN connections doing y Mbps of aggregated data transfer on a specific hardware.

· The number of simultaneous VPN connections and aggregated VPN server throughput that we have used in the test are some of our internal benchmark numbers – based upon our understanding of common customer deployment scenarios of RRAS. This by no means is the only deployment scenario of RRAS.

· The performance numbers without hardware specification is meaningless. Hence, we have shared the details of server hardware used in our performance lab. However, this should not be read as Microsoft recommended hardware platform for RRAS.

· All our tests are done inside our lab environment which means minimal delay (< 10msec) and close to zero % data loss. You may say that is not close to real deployment. And the way I see this – the delay and loss may change the data throughput numbers as experienced by a VPN client for a given tunnel type. However delay and loss doesn’t drastically change the aggregated throughput as seen on VPN server and our focus has been on VPN server performance – hence this set-up.

· This blog is focussed on Windows server 2008 as the VPN server and performance is compared between PPTP and SSTP. I will extend this blog with Windows 7 results shortly – including results for “VPN reconnect” or IKEv2 based VPN tunnel.

Setup:

· 1 VPN server: HP DL 165 G5 server with two AMD Opteron™ 2352 Quad Core Processor 2.10 GHz, 16GB RAM, two 1 Gig Ethernet port – running Windows server 2008 released version.

· 10 machines - code changed to emulate n VPN client connections per machine. Each of these machines are running internal tools to manage VPN connection management and generated data load.

· All machines connected on a Gigabit Ethernet switched network.

Performance Test 1:

· Generate 100 Mbps data load using 1000 VPN clients. Measure the average CPU utilization on the VPN Server.

Tunnel Type

Average CPU usage (sum of CPU usage per core/no of core) – in %

Data Throughput (on VPN server) – in Mega bits/sec

PPTP

13.23

100

SSTP

33.65

100

Performance Test 2:

· Generate maximum data load from a single VPN client connection. Measure the aggregate data throughput and average CPU utilization on the VPN server

Tunnel Type	Average CPU usage (sum of CPU usage per core/no of core) – in %	Maximum Data Throughput (on VPN server) – in Mega bits/sec
PPTP	40.29	644.78
SSTP	71.44	685.96

Performance Test 3:

· Generate a constant background data load (0, 25 Mbps, 100 Mbps) using 1000 VPN clients and in parallel start a 580 Mega byte file transfer from one of the VPN client to machine behind VPN Server. Measure the file transfer time and average CPU utilization on the VPN Server.

Tunnel Type	Average CPU usage (sum of CPU usage per core/no of core) – in %	Time taken to transfer 580 MB file - in seconds
PPTP with 0 Mbps of traffic	26.42	14
PPTP with 25 Mbps of traffic	27.24	20
PPTP with 100 Mbps of traffic	33.08	30
SSTP with 0 Mbps of traffic	30.38	13
SSTP with 25 Mbps of traffic	40.91	18
SSTP with 100 Mbps of traffic	61.22	18

I hope that the above performance results helps you better understand and evaluate RRAS performance and do capacity planning for your deployment.

The performance measurement is a difficult field with various factors affecting numbers. My recommendation is to evaluate the performance in view of your WAN bandwidth of VPN server and number of clients connecting to it – as these parameters are closest and most important to a practical deployment. I will like to hear back from you, so feel free to send in your comments on this blog or send us email to our blog link as mentioned above.

With Regards,

Samir Jain

Senior Program Manager

Windows Networking

[This posting is provided "AS IS" with no warranties, and confers no rights.]

VPN – NLB

rrasblog — Thu, 16 Feb 2006 14:33:00 GMT

Network Load Balancing is intended for stateless applications that do not have long-running in-memory state. Such application treats each client request as an independent operation, and therefore it can load-balance each request independently. Stateless applications often have read-only data or data that changes infrequently. IIS servers, virtual private networks (VPNs), and File Transfer Protocol (FTP) servers typically use Network Load Balancing. Network Load Balancing clusters can also support other TCP- or UDP-based services and applications.

Network Load Balancing can combine up to 32 servers.

Virtual Private Network - Network Load Balancing can be used with virtual private network (VPN) servers to load-balance PPTP clients.

Scenario – Ceate a cluster of 2 RAS servers so that the load can be balanced between these two RAS servers.

Steps to create this cluster –

· Check that the RAS servers are able to ping each other.

· Install “Network Load Balacing” (NLB) driver on the network interface of both these RAS servers.

· The Network Load Balancing device driver Wlbs.sys is loaded onto each host in the cluster and includes the statistical mapping algorithm that the cluster hosts collectively use to determine which host handles each incoming request.

· Both these network interface on the RAS server will get the same Media Access Control (MAC) address.

· Now try to ping the RAS servers they will not be able to ping each other.

· Configure the properties for NLB by going to nlbmgr.msc from command prompt.

· In NLB properties enter a virtual IP that the clients will use to connect to the RAS server. This virtual IP will be shared by both the RAS servers.

· To enable Network Load Balancing in Windows Server 2003 support for both Point-to-Point Tunneling Protocol (PPTP) and Layer Two Tunneling Protocol (L2TP) virtual private network (VPN) sessions, Network Load Balancing must be configured in single affinity mode.

· You need to select one RAS server as Host1 (with priority 1) and other RAS server as Host2 (with priority 2), which will act as the failover server i.e. in case of failure of the first server it will act as the backup server.

· Go to the command prompt of the ras server and give the command “wlbs display”. It will give the latest status of the cluster.

· Run command “nlb query” to get the status of the host.

After the cluster is created and the convergence has happened, you can connect from the client by giving the virtual IP address.

What is "NLB Drainstop" –

· When you make VPN connections to the cluster from RAS clients all the calls will be redirected to one RAS server which is the primary server.

· If you run the command “nlb drainstop” on the primary RAS server it will stop taking any more connections.

· All the new VPN connections will be re-directed to the failover RAS server.

· To enable the primary RAS server to start taking new VPN connections once again, run the command “nlb start” on the primary server.

For more information on NLB refer to the MSDN article at - http://technet2.microsoft.com/WindowsServer/en/Library/c1db8c13-da31-4541-81d8-e2b3ebe742fb1033.mspx

Puja Pandey
Software Design Engineer/Test
Windows Networking Group

[This posting is provided "AS IS" with no warranties, and confers no rights.]

Tunnel Type	Average CPU usage (sum of CPU usage per core/no of core) – in %	Data Throughput (on VPN server) – in Mega bits/sec
PPTP	13.23	100
SSTP	33.65	100